PLATFORMS Signal 111
Amazon EBS Volume Clones gain cross-account copy with optional KMS re-encryption
↗
Amazon EBS Volume Clones now support copying volumes across AWS accounts, with optional re-encryption using a customer managed key in the target account.
This lets teams refresh test and development environments from production data without exposing production encryption keys. It also simplifies sharing volumes across accounts while maintaining encryption control, but requires careful RAM sharing and same-AZ placement.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Cross-account copy requires sharing the volume via AWS Resource Access Manager (RAM) and accepting the share in the target account.
Only unencrypted volumes or volumes encrypted with a customer managed key (CMK) can be shared; the CMK must also be shared, and you can re-encrypt with a different CMK.
The copy must be in the same Availability Zone as the source, and you pay a one-time fee based on volume size to the target account.
THE CLUSTER